Month End Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: buysanta

Exact2Pass Menu

Question # 4

When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?

A.

1. Delete Splunk Enterprise, if it exists.2. Install and initialize the instance.3. Join the SHC.

B.

1. Install and initialize the instance.2. Delete Splunk Enterprise, if it exists.3. Join the SHC.

C.

1. Initialize cluster rebalance operation.2. Remove master node from cluster.3. Trigger replication.

D.

1. Trigger replication.2. Remove master node from cluster.3. Initialize cluster rebalance operation.

Full Access
Question # 5

What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

A.

Distributes apps to SHC members.

B.

Bootstraps a clean Splunk install for a SHC.

C.

Distributes non-search-related and manual configuration file changes.

D.

Distributes runtime knowledge object changes made by users across the SHC.

Full Access
Question # 6

When configuring a Splunk indexer cluster, what are the default values for replication and search factor?

A.

replication_factor = 2search_factor = 2

B.

replication_factor = 2search factor = 3

C.

replication_factor = 3search_factor = 2

D.

replication_factor = 3search factor = 3

Full Access
Question # 7

A Splunk architect has inherited the Splunk deployment at Buttercup Games and end users are complaining that the events are inconsistently formatted for a web source. Further investigation reveals that not all weblogs flow through the same infrastructure: some of the data goes through heavy forwarders and some of the forwarders are managed by another department.

Which of the following items might be the cause of this issue?

A.

The search head may have different configurations than the indexers.

B.

The data inputs are not properly configured across all the forwarders.

C.

The indexers may have different configurations than the heavy forwarders.

D.

The forwarders managed by the other department are an older version than the rest.

Full Access
Question # 8

To activate replication for an index in an indexer cluster, what attribute must be configured in indexes.conf on all peer nodes?

A.

repFactor = 0

B.

replicate = 0

C.

repFactor = auto

D.

replicate = auto

Full Access
Question # 9

A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)

A.

Via Splunk Web.

B.

Directly edit SPLUNK_HOME/etc./system/local/server.conf

C.

Run a Splunk edit cluster-config command from the CLI.

D.

Directly edit SPLUNK_HOME/etc/system/default/server.conf

Full Access
Question # 10

Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the _introspection index. Which of the following logs are included in this index? (Select all that apply.)

A.

audit.log

B.

metrics.log

C.

disk_objects.log

D.

resource_usage.log

Full Access
Question # 11

Which of the following are client filters available in serverclass.conf? (Select all that apply.)

A.

DNS name.

B.

IP address.

C.

Splunk server role.

D.

Platform (machine type).

Full Access
Question # 12

Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?

A.

Setting the cluster search factor to N-1.

B.

Increasing the number of buckets per index.

C.

Decreasing the data model acceleration range.

D.

Setting the cluster replication factor to N-1.

Full Access
Question # 13

Which of the following should be included in a deployment plan?

A.

Business continuity and disaster recovery plans.

B.

Current logging details and data source inventory.

C.

Current and future topology diagrams of the IT environment.

D.

A comprehensive list of stakeholders, either direct or indirect.

Full Access
Question # 14

Which CLI command converts a Splunk instance to a license slave?

A.

splunk add licenses

B.

splunk list licenser-slaves

C.

splunk edit licenser-localslave

D.

splunk list licenser-localslave

Full Access
Question # 15

When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

A.

Auto

B.

None

C.

True

D.

False

Full Access
Question # 16

Before users can use a KV store, an admin must create a collection. Where is a collection is defined?

A.

kvstore.conf

B.

collection.conf

C.

collections.conf

D.

kvcollections.conf

Full Access
Question # 17

Which of the following should be done when installing Enterprise Security on a Search Head Cluster? (Select all that apply.)

A.

Install Enterprise Security on the deployer.

B.

Install Enterprise Security on a staging instance.

C.

Copy the Enterprise Security configurations to the deployer.

D.

Use the deployer to deploy Enterprise Security to the cluster members.

Full Access
Question # 18

Which of the following describe migration from single-site to multisite index replication?

A.

A master node is required at each site.

B.

Multisite policies apply to new data only.

C.

Single-site buckets instantly receive the multisite policies.

D.

Multisite total values should not exceed any single-site factors.

Full Access
Question # 19

What is a Splunk Job? (Select all that apply.)

A.

A user-defined Splunk capability.

B.

Searches that are subjected to some usage quota.

C.

A search process kicked off via a report or an alert.

D.

A child OS process manifested from the splunkd process.

Full Access
Question # 20

Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?

A.

Increase the maximum number of hot buckets in indexes.conf

B.

Increase the number of parallel ingestion pipelines in server.conf

C.

Decrease the maximum size of the search pipelines in limits.conf

D.

Decrease the maximum concurrent scheduled searches in limits.conf

Full Access
Question # 21

A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)

A.

The field was extracted as a private knowledge object.

B.

The events are tagged as communicate, but are missing the network tag.

C.

The Typing Queue, which does regular expression replacements, is blocked.

D.

The colleague did not explicitly use the field in the search and the search was set to Fast Mode.

Full Access
Question # 22

Which server.conf attribute should be added to the master node's server.conf file when decommissioning a site in an indexer cluster?

A.

site_mappings

B.

available_sites

C.

site_search_factor

D.

site_replication_factor

Full Access
Question # 23

Stakeholders have identified high availability for searchable data as their top priority. Which of the following best addresses this requirement?

A.

Increasing the search factor in the cluster.

B.

Increasing the replication factor in the cluster.

C.

Increasing the number of search heads in the cluster.

D.

Increasing the number of CPUs on the indexers in the cluster.

Full Access
Question # 24

Which of the following tasks should the architect perform when building a deployment plan? (Select all that apply.)

A.

Use case checklist.

B.

Install Splunk apps.

C.

Inventory data sources.

D.

Review network topology.

Full Access
Question # 25

Which two sections can be expanded using the Search Job Inspector?

A.

Execution costs.

B.

Saved search history.

C.

Search job properties.

D.

Optimization suggestions.

Full Access
Question # 26

When planning a search head cluster, which of the following is true?

A.

All search heads must use the same operating system.

B.

All search heads must be members of the cluster (no standalone search heads).

C.

The search head captain must be assigned to the largest search head in the cluster.

D.

All indexers must belong to the underlying indexer cluster (no standalone indexers).

Full Access